fix(deps): patch CI audit vulnerabilities - #2420
Merged
Merged
Conversation
Keep the production dependency audit green after newly published advisories.
|
🤖 Review skipped: Repository Owner rate limit exceeded. Free accounts are limited to 3 reviews per 4 hours across all repositories. Upgrade to a paid plan for unlimited reviews. |
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
Reviewer's GuideUpdates pnpm workspace security overrides to patched versions for three transitive dependencies, regenerates the lockfile, and documents CI dependency-audit and local Docker/Redpanda validation incidents in the production incident baseline. Sequence diagram for CI dependency audit with updated pnpm security overridessequenceDiagram
actor Developer
participant GitHubActionsCI as GitHubActionsCI
participant pnpm as pnpm_audit
participant Overrides as pnpm_overrides
Developer->>GitHubActionsCI: push commit
GitHubActionsCI->>pnpm: pnpm audit --prod --audit-level=high --ignore-registry-errors
pnpm->>Overrides: apply overrides (brace-expansion, fast-uri, ip-address)
alt before_override_update
pnpm-->>GitHubActionsCI: fail on GHSA-rgw5-rvv9-x895 (brace-expansion)
pnpm-->>GitHubActionsCI: fail on GHSA-7p8r-x3mc-p8w7 (fast-uri)
pnpm-->>GitHubActionsCI: fail on GHSA-mwp4-54f8-5fhr (ip-address)
else after_override_update
Overrides->>Overrides: set brace-expansion 5.0.9
Overrides->>Overrides: set fast-uri 3.1.5
Overrides->>Overrides: set ip-address 10.4.0
pnpm-->>GitHubActionsCI: pass high-severity audit
end
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
PR Summary by QodoPatch pnpm overrides to clear CI security audit
AI Description
Diagram
High-Level Assessment
Files changed (3)
|
Code Review by Qodo
Context used✅ Compliance rules (platform):
152 rules✅ Skills:
fix-provider, write-tests, cloudflare 1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
📝 WalkthroughWalkthroughThe workspace now applies updated dependency overrides, the mobile app uses ChangesProduction baseline and deployment fixes
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
Storybook previews for This comment updates automatically on each PR push. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/production-incident-baseline.md`:
- Around line 22513-22518: Update the production incident entry before the Root
cause section to include the exact audit command used and the first fatal output
line reported for GHSA-mwp4-54f8-5fhr. Preserve the existing Symptoms and Root
cause details, and ensure the added evidence is specific enough for another
reviewer to reproduce the failure.
- Around line 22432-22433: Update the User impact statement in the incident
baseline to use “No production impact was observed,” unless traceable production
deployment or release-check evidence is added to verify that no affected
artifact reached production.
In `@pnpm-workspace.yaml`:
- Line 45: Update the pnpm override for brace-expansion so it is scoped by
compatible dependency path and major version: upgrade minimatch where possible,
while pinning lerna>minimatch to a patched brace-expansion 1.x release instead
of forcing 5.0.9 onto minimatch@3.1.4.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c4e91160-0178-482d-a712-2de3cb55f20e
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
docs/production-incident-baseline.mdpnpm-workspace.yaml
|
🤖 Review skipped: Repository Owner rate limit exceeded. Free accounts are limited to 3 reviews per 4 hours across all repositories. Upgrade to a paid plan for unlimited reviews. |
|
🤖 Review skipped: Repository Owner rate limit exceeded. Free accounts are limited to 3 reviews per 4 hours across all repositories. Upgrade to a paid plan for unlimited reviews. |
|
🤖 Review skipped: Repository Owner rate limit exceeded. Free accounts are limited to 3 reviews per 4 hours across all repositories. Upgrade to a paid plan for unlimited reviews. |
|
🤖 Review skipped: Repository Owner rate limit exceeded. Free accounts are limited to 3 reviews per 4 hours across all repositories. Upgrade to a paid plan for unlimited reviews. |
Contributor
Mobile PreviewScan to open on device:
To test on device:
|
|
🤖 Review skipped: Repository Owner rate limit exceeded. Free accounts are limited to 3 reviews per 4 hours across all repositories. Upgrade to a paid plan for unlimited reviews. |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/production-incident-baseline.md`:
- Around line 22571-22572: Update the active-session impact statement in the
incident entry to cite the specific read-only checks, run identifier, or
health/metrics evidence and summarize their result; if no traceable evidence is
available, replace the definitive claim with wording that limits it to what was
verified in the available checks.
In `@scripts/validate-deploy-env.test.ts`:
- Around line 56-58: Update the missing-key fixture setup in the test using
validEnvironment so it remains type-safe under strict TypeScript: make the
fixture type allow optional environment keys, or assign undefined instead of
deleting required properties. Preserve the test’s behavior of validating a
missing EXPO_APP_ID.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 9d5eb8d3-f187-4b7b-b06c-11fde6b0a7de
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (7)
deploy/README.mddeploy/stack.ymldocs/production-incident-baseline.mdpackages/mobile/package.jsonpnpm-workspace.yamlscripts/validate-deploy-env.test.tsscripts/validate-deploy-env.ts
|
LGTM! The addition of 🤖 Reviewed by codereviewbot.ai - Catch bugs before your team does. |
Asherlc
enabled auto-merge (squash)
August 4, 2026 04:31
Asherlc
pushed a commit
that referenced
this pull request
Aug 4, 2026
Expo's published SDK 57 native-modules map now expects react-native-gesture-handler ~2.32.0, reversing the ~3.1.0 requirement that motivated yesterday's bump in PR #2420. `pnpm expo install --check` validates against Expo's live version map rather than anything in the repo, so it now fails on main's head too, with the exact same dependency set that passed CI this morning. Root cause: expo, expo-linking, expo-modules-core, expo-router, and expo-updates patch versions and react-native-gesture-handler's expected range all changed upstream between this morning's green run and now. Fix: bump the five expo packages to their now-expected patch versions and revert react-native-gesture-handler to 2.32.0, matching https://api.expo.dev/v2/sdks/57.0.0/native-modules. Verified locally with `pnpm expo install --check` (passes) and `pnpm test:mobile` (176 files, 1476 tests pass). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JvC38Y81GUpfMTy2a9YkCu
Asherlc
added a commit
that referenced
this pull request
Aug 4, 2026
* fix(clickhouse): repair stale canonical activity type views ClickHouse stores the query text a view is created with, and `standardViewHeader()` emits `CREATE VIEW IF NOT EXISTS`. Migration 0069 renamed `activity_type` to `canonical_type` on `postgres_fitness.activity` and the analytics serving tables while PR #2416 updated the matching view bodies, but neither view was dropped first, so the recreate was a no-op against the existing production objects. `analytics.activity_summary` and `analytics.v_activity` kept selecting a column that no longer exists, and every server read of the summary view failed with UNKNOWN_IDENTIFIER. Migration 0071 drops and recreates the three affected views from the current builders. It then backfills the `provider_type` and `modality` columns that 0069 added without values: the dbt models that own those tables pick dirty keys from `_peerdb_synced_at`, which a mutation does not advance, so historical rows would have stayed null indefinitely. The backfill copies provenance from the replicated activity rows through a temporary Join-engine lookup and `joinGet`, bounded to live rows that are still missing it, and drops the lookup when it finishes. Extracts the duplicated column-existence probe into a shared `hasClickHouseColumn` helper and the migration test client into a local `test-helpers.ts`. Fixes DOFEK-SERVER-53 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MeXWX6Z7h5uWtVByYo26zd * test(clickhouse): name the missing-replica activity fixture in words cspell rejected "unreplicated". Rename the fixture and its assertion to describe the same case with dictionary words rather than widening the project dictionary for one coined term. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MeXWX6Z7h5uWtVByYo26zd * refactor(clickhouse): validate column introspection rows with zod Parse the system.columns response with a Zod schema instead of trusting a TypeScript interface across the ClickHouse runtime boundary. The count comes back as a string for 64-bit integers, so the schema admits both. Also records why provider_type alone marks a row as un-backfilled: a null modality is a legitimate resting state for many canonical types, so widening the filter would rewrite correct rows on every run without converging. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MeXWX6Z7h5uWtVByYo26zd * fix(deps): clear high advisories and align the mobile gesture peer Both checks failed on the base branch and tripped fail-fast, cancelling the unit, integration, and E2E jobs, so nothing in this PR was being exercised by CI. pnpm audit --prod --audit-level=high reported three high advisories, all in transitive dependencies the workspace already pins. Advance those pins to the patched releases rather than lowering the audit level: brace-expansion to 5.0.9 (GHSA-rgw5-rvv9-x895), fast-uri to 3.1.5 (GHSA-7p8r-x3mc-p8w7), and ip-address to 10.4.0 (GHSA-mwp4-54f8-5fhr). The fast-uri selector moves with its advisory range, and staying inside each existing major keeps the parents' ranges satisfied. expo install --check required react-native-gesture-handler ~3.1.0 against a 2.32.0 pin. No workspace source imports the package — it is a peer of expo-router and react-navigation — so the major bump carries no API surface of ours. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MeXWX6Z7h5uWtVByYo26zd * docs(incident): record the OTA healthcheck outage as unresolved Adds the two CI failures fixed alongside this change, including the pnpm 10+ detail that overrides live in pnpm-workspace.yaml rather than package.json, and records the Publish Mobile Preview OTA healthcheck 404 as an unresolved production service state rather than omitting it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MeXWX6Z7h5uWtVByYo26zd * fix(deploy): pass EXPO_APP_ID to the OTA update service expo-open-ota reads EXPO_APP_ID at startup and logs "EXPO_APP_ID not set" without it, leaving dofek_ota at 0/1 so ota.dofek.asherlc.com/hc answers 404 and the preview publish workflow fails its healthcheck before reaching eoas publish. The variable was already present in Infisical, but the ota service in deploy/stack.yml never referenced ${EXPO_APP_ID}, so it was never interpolated into the container. The dotenv template renders every secret at the project root and docker stack deploy runs with that dotenv loaded, so naming the variable is all that was missing. Also adds EXPO_APP_ID to REQUIRED_DEPLOY_KEYS so an absent value fails the deploy with a named key rather than surfacing later as a healthcheck 404, closing the fail-fast follow-up left open by the earlier staging incident. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MeXWX6Z7h5uWtVByYo26zd * fix(mobile): align Expo SDK 57 dependency pins Expo's published SDK 57 native-modules map now expects react-native-gesture-handler ~2.32.0, reversing the ~3.1.0 requirement that motivated yesterday's bump in PR #2420. `pnpm expo install --check` validates against Expo's live version map rather than anything in the repo, so it now fails on main's head too, with the exact same dependency set that passed CI this morning. Root cause: expo, expo-linking, expo-modules-core, expo-router, and expo-updates patch versions and react-native-gesture-handler's expected range all changed upstream between this morning's green run and now. Fix: bump the five expo packages to their now-expected patch versions and revert react-native-gesture-handler to 2.32.0, matching https://api.expo.dev/v2/sdks/57.0.0/native-modules. Verified locally with `pnpm expo install --check` (passes) and `pnpm test:mobile` (176 files, 1476 tests pass). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JvC38Y81GUpfMTy2a9YkCu * docs(incident): disambiguate the fail-fast CI failure count CodeRabbit flagged that "Two CI failures" read ambiguously against the separately-described OTA workflow failure later in the same entry. Scope the count to what it actually describes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JvC38Y81GUpfMTy2a9YkCu * fix(deploy): fail closed on the OTA JWT and signing key secrets CodeRabbit flagged that OTA_JWT_SECRET, OTA_PRIVATE_KEY_B64, and OTA_PUBLIC_KEY_B64 rendered as empty strings rather than failing the deploy when absent. This was previously declined pending confirmation that all three are actually populated in Infisical -- the repository owner has now confirmed that. Add :? guards to the three interpolations in deploy/stack.yml and add them to REQUIRED_DEPLOY_KEYS in scripts/validate-deploy-env.ts, so a missing value fails the deploy with a named key instead of starting the OTA container misconfigured. Validated: `docker stack config -c deploy/stack.yml` renders the ota service correctly with all three vars set, and fails with a named "OTA_JWT_SECRET is required" error when one is unset. Unit tests pass (7/7 in validate-deploy-env.test.ts). tsc --noEmit clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JvC38Y81GUpfMTy2a9YkCu --------- Co-authored-by: Claude <noreply@anthropic.com>
This was referenced Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
brace-expansion,fast-uri, andip-addressto patched stable versions and regenerated the lockfile.Validation
pnpm audit --prod --audit-level=high --ignore-registry-errors,pnpm lint, root/server/web TypeScript checks, frozen install, andpnpm test(1,110 files / 16,691 tests) pass.Summary by Sourcery
Update dependency overrides and lockfile to address newly published security advisories and document the associated CI audit and local validation incidents in the production incident baseline.
Bug Fixes:
Documentation:
Summary by cubic
Patched newly published advisories to keep the CI dependency audit green, aligned Expo SDK 57 by bumping
react-native-gesture-handler, and fixed OTA preview by requiring and passingEXPO_APP_ID. Regenerated the lockfile, updated docs and tests, and marked the OTA rollout verified in the incidents log.Dependencies
brace-expansionto 5.0.9.minimatch@3>brace-expansionto 1.1.18.fast-urito 3.1.5.ip-addressto 10.4.0.react-native-gesture-handlerto 3.1.0 (Expo SDK 57 compatibility).Migration
EXPO_APP_IDin deploy secrets; OTA service requires it viadeploy/stack.yml.scripts/validate-deploy-envenforces it;deploy/README.mdand tests updated.Written for commit 04760f9. Summary will update on new commits.
Summary by CodeRabbit
Bug Fixes
Documentation